URL:

https://www.mediafire.com/file/sdabx6l9jmykx8i/soundpad_3.3.2.0.zip/file

Full analysis: https://app.any.run/tasks/86ce5869-c585-4ccf-a940-ff588cad0867
Verdict: Malicious activity
Analysis date: January 23, 2024, 19:04:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C6ED7F79441B24410062E34065085462

SHA1:

EA5B0F70613DD2DC310CEAB0787AAAD63AEF4728

SHA256:

CFB74ACDAED79AC5490F7B0605063111C7819C62D6A431378A1B1525308CE360

SSDEEP:

3:N8DSLw3eGUoLvcpOdML7dky:2OLw3eG3UyML7dky

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Soundpad 3.3.2.0.exe (PID: 2812)
      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.exe (PID: 2748)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Soundpad 3.3.2.0.exe (PID: 2812)
      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.exe (PID: 2748)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

    • Reads the Windows owner or organization settings

      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

    • Uses REG/REGEDIT.EXE to modify registry

      • Soundpad 3.3.2.0.tmp (PID: 2132)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1856)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1844)
      • sipnotify.exe (PID: 1856)

    • Process drops legitimate windows executable

      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1856)

  • INFO

    • Checks supported languages

      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.exe (PID: 2812)
      • IMEKLMG.EXE (PID: 2084)
      • IMEKLMG.EXE (PID: 2096)
      • wmpnscfg.exe (PID: 2348)
      • wmpnscfg.exe (PID: 2372)
      • Soundpad 3.3.2.0.exe (PID: 2748)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

    • Create files in a temporary directory

      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.exe (PID: 2812)
      • msiexec.exe (PID: 3664)
      • Soundpad 3.3.2.0.exe (PID: 2748)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

    • Manual execution by a user

      • explorer.exe (PID: 3572)
      • Soundpad 3.3.2.0.exe (PID: 2812)
      • Soundpad 3.3.2.0.exe (PID: 3884)
      • IMEKLMG.EXE (PID: 2084)
      • IMEKLMG.EXE (PID: 2096)
      • wmpnscfg.exe (PID: 2372)
      • Soundpad 3.3.2.0.exe (PID: 2640)
      • Soundpad 3.3.2.0.exe (PID: 2748)
      • wmpnscfg.exe (PID: 2348)
      • notepad.exe (PID: 3024)
      • explorer.exe (PID: 2844)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2944)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2944)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2944)
      • iexplore.exe (PID: 2628)

    • Application launched itself

      • iexplore.exe (PID: 2628)

    • Reads the computer name

      • IMEKLMG.EXE (PID: 2084)
      • IMEKLMG.EXE (PID: 2096)
      • Soundpad 3.3.2.0.tmp (PID: 2132)
      • Soundpad 3.3.2.0.exe (PID: 2812)
      • wmpnscfg.exe (PID: 2348)
      • wmpnscfg.exe (PID: 2372)
      • Soundpad 3.3.2.0.tmp (PID: 2768)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2084)
      • IMEKLMG.EXE (PID: 2096)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1856)

    • Creates files in the program directory

      • Soundpad 3.3.2.0.tmp (PID: 2132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
115
Monitored processes
20
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe explorer.exe no specs soundpad 3.3.2.0.exe no specs soundpad 3.3.2.0.exe soundpad 3.3.2.0.tmp msiexec.exe no specs regedit.exe ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs soundpad 3.3.2.0.exe no specs soundpad 3.3.2.0.exe soundpad 3.3.2.0.tmp explorer.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2628 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1844C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1856C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2096"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2132"C:\Users\admin\AppData\Local\Temp\is-4SCJN.tmp\Soundpad 3.3.2.0.tmp" /SL5="$B01DA,6996435,67072,C:\Users\admin\Documents\Soundpad 3.3.2.0.exe" C:\Users\admin\AppData\Local\Temp\is-4SCJN.tmp\Soundpad 3.3.2.0.tmp
Soundpad 3.3.2.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-4scjn.tmp\soundpad 3.3.2.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2348"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2372"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2628"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.mediafire.com/file/sdabx6l9jmykx8i/soundpad_3.3.2.0.zip/file"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1073807364
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2640"C:\Users\admin\Documents\Soundpad 3.3.2.0.exe" C:\Users\admin\Documents\Soundpad 3.3.2.0.exe—explorer.exe
User:
admin
Company:
lrepacks.ru
Integrity Level:
MEDIUM
Description:
Soundpad Setup
Exit code:
3221226540
Version:
3.3.2.0.0
Modules
Images
c:\users\admin\documents\soundpad 3.3.2.0.exe
c:\windows\system32\ntdll.dll
Total events
26 385
Read events
26 216
Write events
146
Delete events
23

Modification events

(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
22
Suspicious files
176
Text files
101
Unknown types
11

Dropped files

PID
Process
Filename
Type
664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:9F4F7A385D206559A54D29A6F7E10112
SHA256:3339FE7938169F3139D125AB1879A36CF1AD2571FC5D13A09E9C455AE0D69412
664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:85D7DB109B952916134DBDCE2A1C5A45
SHA256:63B1CA84352D833F1C93E4C7C6134A834FC719B2DB7649DB6DAE34214EE0F630
664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:E6B0FB605BFBF5D8A136A89355DF0513
SHA256:A69BCBDF23B5B4E471421DDFB08872E87C6CF039C9974DD6A3FB017BC61E100D
664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZJSYKSK2.txttext
MD5:8CF745AAE77AE6BFDC2B0518270CB59D
SHA256:48505F1CB8367C385C9531C376BBDB2109D3CAF2AA78980717118F80C359F0E3
664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:8761661A074F898D61AE0DF7213D6CBE
SHA256:B87890CC9D309831D4C52CDAB889FAEBF1196FABF56CE90F599E917DEBAC514F
664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:EE31326360FF4D672C4CC5A1BCC1194D
SHA256:330B423C925889954DB2F9E70FA18137F7C4A715CD77A62CDC345D68DABAB395
664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:DEE1CB98104931DB27A73DCBA2CDF91C
SHA256:52F35D6BDD32064C55A7C1C7F3B9E349E30912B7F922569A5BBF45E150127AE8
664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\35KR8A14.txttext
MD5:7BDEE5F5594823891CA8DA6C0C743F73
SHA256:D17EB36CB18E73CE8017049310FCE2D0524B91F777EEF3C50997C9309434216D
664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\file[1].htmhtml
MD5:43B0F63BABF049F10270EE718536C1E6
SHA256:2F950D47042B4FE73262E268CCC9BCFBCF529B3CEBD3AECC9BB18A1D9A1F9A80
664iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\5JY9YLZP.txttext
MD5:5911E023811CF19F880244938779396F
SHA256:B70B2FEB932F73FD0C6143A6AB500EC5F55B08FE622A2220447967755E4B8411
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
94
DNS requests
43
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f27fe043238c6b38
unknown
—
—
unknown
664
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?96e261c22e45b24e
unknown
—
—
unknown
664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
unknown
binary
2.18 Kb
unknown
664
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
664
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
664
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
664
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
664
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
664
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
664
iexplore.exe
104.16.113.74:443
www.mediafire.com
CLOUDFLARENET
—
unknown
664
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
664
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
664
iexplore.exe
142.250.186.72:443
www.googletagmanager.com
GOOGLE
US
unknown
664
iexplore.exe
172.67.41.60:443
btloader.com
CLOUDFLARENET
US
unknown
664
iexplore.exe
104.21.42.32:443
the.gatekeeperconsent.com
CLOUDFLARENET
—
unknown
664
iexplore.exe
172.64.128.8:443
www.ezojs.com
CLOUDFLARENET
US
shared

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.16.113.74
  • 104.16.114.74
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.182
  • 2.23.209.154
  • 2.23.209.158
  • 2.23.209.156
  • 2.23.209.160
  • 2.23.209.193
  • 2.23.209.176
  • 2.23.209.189
  • 2.23.209.183
whitelisted
the.gatekeeperconsent.com
  • 104.21.42.32
  • 172.67.199.186
unknown
www.googletagmanager.com
  • 142.250.186.72
whitelisted
btloader.com
  • 172.67.41.60
  • 104.22.75.216
  • 104.22.74.216
whitelisted
www.ezojs.com
  • 172.64.128.8
  • 172.64.129.8
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
Process
Message
regedit.exe
REGEDIT: CreateFile failed, GetLastError() = 2
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/sdabx6l9jmykx8i/soundpad_3.3.2.0.zip/file